K-12 Security Essentials
for Beginners

There are few industries that havefelt the transformational touch oftechnology quite like education.
The advancements in personal computing andthe development of cloud-based services have
revolutionized some core tenets to how learning
occurs, such as:

Access to books and resources have grownexponentially, extending beyond physical limitations.
Global lines of communications between students,
teachers and parents are immediately available.
Standardized testing has been streamlined by moving tocomputer-based models.
The varying needs of students can be addressed throughone common device with specialized apps.
Convergence between multiple modalities of educationand teaching styles can be achieved by integrating
multiple technological tools.
Distance learning has proven to be a viable method of
education, despite an ongoing pandemic or other global
crisis.

Creatinga vision

It’s clear that technology as a whole has been
embraced by K-12 education since day one when oneof Apple’s earliest computers, the Apple IIe, taught
young minds in 1983 how to add, read and type. Thosechildren are now adults – and in some instances
educators themselves – continuing this practice byusing the latest MacBook Air and iPad, alongside a
growing catalog of nearly 2 million apps, to educate
the students of today.
Unlike forty years ago when cybersecurity wasn’t even aterm to consider, today’s modern computing landscapeis vastly different. Even going fifteen years back, it wasn’t
anything like the present, filled with myriad threats to thesecurity of your devices. From restricting access to critical
data and services by infecting them with ransomware
to compromising student records and sensitive data
through data breaches – current threats may even posea significant safety-to-life risk through the unauthorized
capture of privacy data.
This e-book isn’t intended to instill fear, but rather
raise awareness of the very real and sometimes scary
security concerns that affect education.

Creatinga vision

Taking a step back from the scarier elements, more
often, threats manifest as loss of device usage and/or limited access to resources. In turn, these delays
prevent learning from taking place. Furthermore,regulations in place to curb these situations fromoccurring are sometimes tied to funding structures that
directly impact a school’s ability to provide the level ofservice their stakeholders and communities require if aviolation to compliance has been deemed.

In this e-book, we address the unique
cybersecurity threats that impact K-12
education, highlight why it is so critical toproactively address them and:Look at the crucial role cybersecurity plays
today – and in the future of education tocome.
Illustrate the external and internal threatsthat make up the majority of malicious
attacks against K-12.
Identify which practices can bestrengthened to safeguard devices,confidential data and students.
Address common misconceptions relating toApple and security.
Discuss how stakeholders training programs
contribute to successful cybersecurity
programs.
Explain how Jamf solutions mitigate risk
while comprehensively securing yourendpoint fleet.

Welcome to
Hogwarts
In the Wizarding World of Harry Potter, the titular character

Well, cybersecurity and how it addresses the unique– a student with incredible potential – attends Hogwarts

needs and requirements of the K-12 education sector –where he and fellow students receive an education inwhen implemented successfully – works in much the same

several different modalities relating to magic. But that isn’t

fashion. After all, there is no single charm, like Lumos, tothe extent of the knowledge the educators impart, is it?

illuminate the secrets of endpoint protection. Instead, acollection of tools, combined with best practices and end-

No, it isn’t. In fact, the students of Hogwarts, much likeuser training work in conjunction to maintain the security

the real-world counterparts in K-12 schools, embark

posture of your school’s infrastructure.

on a journey of knowledge in many different subjects
throughout their time in school. Some are academic,
others extra-curricular – but all form a tightly-knit andcohesive bond that makes up a comprehensive, wellbalanced education.

Why iscybersecurity soimportant?
Aside from the reasons listed before,
to ensure the safety, confidentiality andintegrity of your endpoints — students,
data, and devices — cybersecurity’s
importance is heightened due to a few
education-specific challenges that,at times, prevent organizations from
implementing the proper solutions to
mitigate malicious threats and combat
attacks.

Budget constraints
A Forbes article about how US schools are struggling to fund in
our future notes that “states that have achieved both equity andadequacy see stronger achievement and graduation rates…”.
Ask almost any educator looking to get a replacement bulb
for their LCD projector or stronger access point to handle thenumber of users connecting to Wi-Fi and they’ve often heard
a reply about lack of funding being the culprit as to why they
didn’t get what they requested.
Budget concerns are often at the core of infrastructure
upgrades seeking to update networking equipment for fasterconnectivity or to support more devices as districts adopt a 1:1
device model, as well as, the procurement of security services
that detect and prevent malware on school-owned equipment.

Legacy infrastructure

Going hand-in-glove with budget constraints, schools areoften forced to “do more with less”. This means keeping
obsolete, outdated equipment in use long after a vendor
stops supporting it. While these antiquated devices still

Shadow IT

work, technically speaking, they often lack the resources
necessary to meet the minimum requirements of modern
apps and services, such as computer-based testing (CBT).

The definition of shadow IT is the use of any type of information
technology device, app or service that is not managed or

Other times, the devices themselves straddle the line

approved by the district’s IT department. This can and doesof usability causing a variety of issues for students andrefer to bringing in a personal computer that gets around theteachers. Making it worse still is the fact that these older

strict configurations of school-issued devices, your own Wi-Fi

devices and apps are no longer supported meaning

router from home to “add or expand” the wireless bandwidth insecurity patches that normally correct bugs in software

your classroom or office and any application or service used inand close vulnerabilities used by malicious threat actors

conjunction with work as a student or educator not approved for

to gain unauthorized access to data are left uncorrected.

use such as a personal Dropbox.

This leaves a gaping hole in security without a meansof defense until new equipment and/or applications arepurchased.

This seems harmless enough, especially when budgeting
concerns limit access to technology that makes life easier, but
it can lead to a huge problem. These apps/services are notproperly vetted to reveals if there are any concerns or liabilities
involved in using them within the district’s network.

Lack of security awareness training
Who has the time to learn about security on top of prepping
the classroom, resolving minor (and not so minor) issues,
caring for the students, drawing up lesson plans, grading
tests and, you know, teaching? We know, it’s tough!
Sadly, threat actors know this too and they not only
leverage this to their gain, but continually count on time
crunch and the lack of security awareness training to
attack the education sector. Training your staff, students
and parents to actively spot email-based malicious content
or text message scams, and develop greater security
hygiene practices at school and home is critical to yourcybersecurity success.

“He who mustnot be named”
The first step the magicians in the Harry Potter series took
toward facing their fears was acknowledging them andpersonifying it by name: Voldemort. It wasn’t until this wasdone that the protagonists could mount a defense against
the evils which threatened them.
Similarly, one of the first things to do in cybersecurity is
perform a risk assessment to determine what equipment,
apps, services, etc., are used by the school district, howoften, to what degree and how it ranks based on its
criticality. Once this has been done, you can then “faceyour fears” by knowing what types of threats affect theitems within your risk assessment.

While these lists can, and will, change depending on
your district’s infrastructure needs, there are several
threats that are accepted as being universal in theirtargeting of K-12 education.

External Threats
Among the varied types of threats that emerge fromThe former threat relies on a type of malware

external sources, some of the most disruptive ones

called ransomware that gets its name by encrypting

come from certain types of malware and Denial ofcommonly used file types, like DOCX and PDF, with

Service (DoS) attacks. The latter seeks to preventa randomly generated key. Once done, the malware

access to applications, services and websites bysignals back to a remote server where a request

sending a flood of requests to the targeted service

is made to decrypt or unlock your documents inessentially preventing it from responding to any

exchange for a monetary payment. These can range

requests — legitimate or otherwise — affectingfrom thousands of dollars to millions of dollars.

even some larger school districts in recent years.
Making matters worse, these types of attacks canbe amplified through multiple computers to form aDistributed Denial of Service (DDoS), which make itmuch more difficult to protect against.

“57% of reported ransomware incidents involved K-12 schools – more than
twice the number of school ransomware attacks reported in the earlier
months of 2020.”– Joint Cybersecurity Advisory coauthored by the Federal Bureau of Investigation(FBI), the Cybersecurity and Infrastructure Security Agency (CISA) and the MultiState Information Sharing and Analysis Center (MS-ISAC)

Other external threats and attacks frequently targeting K-12 systems are:

Malware: A general classification for all pieces ofPhishing: Similar to MitM above, phishing also relies

malicious code, like a virus that runs on a device withon social engineering to fool a user but not throughthe aim of obtaining unauthorized access to the device

technology necessarily. Often, these attacks occur

and/or data, and those connected to it within the same

within email, text message and old-fashioned phone

network.

calls, persuading (or threatening) users with penalties, in

Spyware: This type of malware operates discretely as it
gathers information about the user. It obtains data, suchorder to get users to divulge sensitive information later
used to compromise systems further and perform data
breaches.

as documents, pictures and often looks for Personallyidentifiable Information (PII) that can later be sold byVulnerability Scanning: Based on a legitimate IT

attackers, such as social security numbers, student

process, scanning for issues helps teams to determine

records, recordings made from built-in cameras andwhat problems exist in order to resolve them before they

microphones, location data, credit card and financial

lead to a security incident. Threat actors have access tocredentials.

the same tools as the good guys and use them to actively

Man-in-the-Middle (MitM): When connecting to yourdetermine which devices are vulnerable, then pivot toattack that weakness.

school’s Wi-Fi network, do you know it’s connecting to
the correct service? The aim of MitM attacks is to trick

Communications Hijacking: Attacks against popularusers into connecting to an attacker’s website or service

video and communications software, such as Teams andthat is posing as a legitimate one to harvest credentials

Zoom, occur when rooms have improperly configuredthat are later used to gain further access to districtsettings, permitting outside attackers to disrupt

resources.

communications, compromise conversations, endanger
the wellbeing of students and/or expose sensitive
information.

Internal Threats

Now let’s be clear, any of the external threats listed above can be leveraged as an internal
threat. The two are not mutually exclusive, however, the deciding factor is where the threat
emanates from: internal user or an external, unknown entity. With that said, here is a list ofcommon internal threats affecting K-12:

Social Engineering: While touched upon in the phishing

Data Theft/Exfiltration: Something as ubiquitous as asection earlier, it deserves an additional mention since it

USB Flash Drive allows data to be stored and moved

is often the gateway that allows threats to succeed. For

between devices, and is useful when taking work

example, holding the door open for someone enteringhome with you. However, it can serve a more nefarious

a secured entrance. The gesture is kind but may allow

purpose as a means to move data from a secure location

unauthorized persons to enter areas they are restricted

to a potentially unsecured one or aid in the removal of

from accessing.

confidential records.

Weak Passwords: The easier a password is to

Misconfigured Settings: Computer settings are a lot likeremember, the easier it will be to guess. This, combined

preferences, we all have them and they can differ fromwith stolen credentials below, are two completely

person to person. However, sometimes settings needavoidable threat scenarios.

to be set a certain way in order to secure devices andStolen Credentials: Increased password complexity andavoid potential issues, such as removing the ability for a
web browser to store credentials to prevent anyone fromthe sheer number of passwords in use in both personal

simply walking up to a device and gaining access to yourand professional lives can lead to writing credentials

sensitive data.

down, say, on a sticky note behind your keyboard ormonitor. It may sound laughable but this poses a grave

Removing Endpoint Protection: While this has become

security threat for the user and their data.

more difficult to do over the years, it is still a possibility,

Devices Not Up-to-Date: All devices and apps require
frequent updates to “patch” bugs and vulnerabilities.

with users often citing a decline in performance as themain reason, to remove the same software that protects
your device against malware threats.

Without the latest patches installed, devices are open tointernal and external threats, making it trivial for threats

Shadow IT: Discussed previously, shadow IT’s aim is to

to bypass built-in protections, gather sensitive data andresolve a problem, despite often leaving one or more

further discovery of connected resources.

security-based problems in its wake.

You may be thinking, how is this critical to student success,how does it affect student performance? Cyber security
has both a direct and indirect impact on a stakeholders
ability to learn and work.

Digital divide

No access to devices orresources

Depending on your demographics, the number of students
without access to reliable broadband Internet access athome could vary from the average of 40%, as noted in asurvey by the Public Policy Institute of California (PPIC).
While there have been a number of local, state and federal
initiatives to boast the number of devices in the handsof educators and students in recent years, the digital
divide is still a very real concern for many school districts,
especially when factoring in that these devices and mobile
hotspot Internet access are the only means they haveto take part in distance learning or perform their homelearning assignments.

Simply put, if a device is inaccessible due to a technical issue,
is currently sitting with IT in triage or waiting on a 3rd-party
vendor for service, then staff or student are essentially without
their tools. Same thing applies to software or services that are
unavailable. If they cannot be accessed, that represents lost
opportunities for teaching and learning.

Funding tied to student
progress/test results
Like the digital divide mentioned above, the topic of testing

Student online safety

results and student progress affecting the amount offunding received may well vary from district to district andbe based greatly on demographics for your area.

We all agree that the safety of students and staff are ofparamount importance in K-12 education. Due to the increase

Performance pay or promotions foreducators and administrators

in security threats as technology embeds itself deeper into ourdaily lives, plus the growth of cybersecurity attacks targeting the
education sector, the days of simply installing antivirus software

One-time bonuses for educators

on your devices are long gone.

Increased funding for schools or school
programs

In addition to malware threats and attacks on apps and services,
there are malicious threat actors looking to capitalize by

Access to certain grants or alternative formsof funding

breaching networks to obtain student records to sell on the

Low performing schools may be required tooffer tutoring

unknowingly through cameras or microphones, tracking theirPoorly performing schools may findeducators and administration replaced

dark web. Worse still, lacking the proper security controls can
endanger the well-being of stakeholders by spying on themlocations, or by posing as someone they know to commit more
severe crimes. Educating students on the importance of online
safety while guiding them in learning the skills to self-identify
threats is key to a robust online security curriculum.

Ask M.O.M.
Back in the Wizarding World of Harry Potter, the Ministry of Magic act as thegatekeepers of information and all things relating to magic. In the K-12 education
sector, you’ve got Jamf to help cut through the misinformation to determine what
security practices best apply to your unique needs and, of course, work with you every
step of the way to implement them successfully.

Before we get ahead of ourselves, let’s take a

Education is weak on security: This is certainly how

moment to address some of the common views

it is perceived according to threat analysis and reportand misconceptions pertaining to Apple security,

findings, such as one conducted by Security Scorecard

including perceptions about the role cybersecurity

which found that, “out of 17 industries in the U.S.,

plays in K-12 education.

Education comes last in terms of total cybersecurity.”

Apple doesn’t get viruses: This was never completely
true, Mac just weren’t as popular. Therefore, malicious

Specifically, the report noted that patching cadence
and app and network security were among the highest
concerning pain points.

actors focused on Windows which had a larger market
share. In recent years, this has changed dramatically

Security is difficult & costly: There is a dearth ofand Apple’s skyrocketing growth has proven to be acybersecurity professionals, this much is known. Partsizable target.

of this is due to it not being an easy job to do. With that

Education is highly targeted: True. In fact, a report bysaid, knowing your environment, assessing your needs
and working with trusted partners to address those

Bitdefender found that K-12 is ranked as number two,concerns is paramount for a successful cybersecurity

just behind retail, as the highest target for ransomware.

program. Trusting the “hype” without verifying the

While malware represents only one type of threat, it issolutions is a recipe for disaster, making it a difficult

among the more significant threats.

path to maneuver, and a potentially costly one at that.
In that same vein, throwing your hands up in defeat
has the potential to leave your district open to threats,with the process to clean up a data breach and addresscompliance penalties being a steep cost.

Ask M.O.M.

“Hackers only need to get it right once; weneed to get it right every time.”– Chris Triolo, a security professional at HP

One size fits all solutions: Going hand in glove with theDon’t worry about security unless you’re hacked:

difficulty vs cost above, is the myth of the “one size fits

Dubbed the “bury your head in the sand” approach,all” solution. A vendor can develop multiple solutions

nothing could be further from the truth. The fact is that,that work together to address many threats, sure, but

at one point, all institutions were not affected by athis specifically refers to a single product that claims tosecurity breach…until they were. Being proactive versus

address all threat aspects. Historically, products suchreactive offers district’s the opportunity to monitor foras these have lacked in several of its aims, and in thethreats, detect points of concern and remedy them tocybersecurity realm that won’t cut it.

prevent threats from evolving into something far more

It’s an IT problem: This is more of a generic view held by
many but is important to the discussion of K-12 education.
When framed within concerns over budgets and time,it’s easy for a stakeholder to feel as though there’s a linein the sand the demarcates where their job functions
end and another role begins. The truth is security – likelittering – is everyone’s problem and it’s one that takes
the effort of all stakeholders to uphold. Consider the
analogy about a chain being as strong as its weakest link.

consequential.

Jamf + AppleWorking closely with Apple, each solution is purpose-

while IT and Security teams can rest assured that risks

built to not only protect your devices, users and data,

are mitigated and threats minimized by solutions that

but to do so using the smallest number of resources,

target device management, identity provisioning andso as to work seamlessly within the user experience

authentication and endpoint protection in background.

Apple products are known for.
Together, merging the services and equipment Apple
provides alongside Jamf solutions that address andexceed the unique needs of the K-12 education sector.
Students and teachers can feel empowered, prioritizing
the use of technology in new and imaginative ways,

Apple School Manager(ASM)
Initialize the endpoint management processwith the centralized, cloud-based console thatis as powerful as it is easy to use. Provided freeof charge by Apple, the service synchronizes
purchases made with the online console andprovide IT a means to establish a connection to
the district’s Mobile Device Management (MDM)
software to facilitate automatically enrolling devices
for management.

Jamf School
The flagship EDU solution designed to manage all
devices in the Apple ecosystem yet tailored exclusively
for teachers, instructional technologists and Mac adminsin the education sector. The Jamf School MDM solution
empowers over 36 million students globally by making it

Jamf Proeasy for educators to leverage classroom management
functionality, curate apps, lesson content and restrictions
and easily rollout managed Apple ID’s without needing

The industry-leading MDM solution for organizations that require

to be a wizard — technical or otherwise. Additionally, thean MDM platform with advanced functionality and support

built-in incident management system helps keep track ofmodels. Jamf Pro includes all the same features as Jamf School

issues reported, like devices out on warranty repair, all of

while adding automation and robust integration with otherwhich ultimately build toward a successful cybersecurity

products in your network and systems management stack, suchstrategy.

as Application Programming Interface (API) access to securecommunications between apps and services or highly technicalfeatures that provide dedicated IT teams the extra muscle

Learn Moreneeded to manage multiple schools or an entire school district.

Learn MoreJamf Connect

Leveraging centralized, cloud-based accountmanagement, Jamf Connect is the pivotal crux that allows
accounts to be provisioned for users to authenticate totheir Mac. More than that, it permits them to do so withjust one account – no remembering multiple passwords –achieving true Single Sign-On (SSO) to access all assigned
apps and services, including Multifactor Authentication(MFA) that adds a second layer of access protection.

Learn More

Jamf Protect
Jamf Protect puts the spotlight exclusively on Apple securityby helping Security teams to prevent known malware, detectthreats and use behavioral analytics to identify potential risks toyour devices’ health. Additionally, it boasts real-time alerts andlogging, offering granular visibility into endpoints to not only
achieve your regulatory compliance goals, but provides IT the
opportunity to remediate issues and help users without gettingin their way.

Learn More

Take your education
technology to thenext level

Want more details about what Jamf provides
or have questions about implementing thesetools in your own school? Start a free trial tojump right in.

Request Trial

Or contact your preferred reseller of Apple hardware.